Overview

overview

10

Static

static

3

84dbe15e3c...18.exe

windows7-x64

10

84dbe15e3c...18.exe

windows10-2004-x64

10

Resubmissions

10/08/2024, 04:50

240810-fgasaawglk 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    84dbe15e3cd7b766cadce1a32d873004_JaffaCakes118

  • Size

    321KB

  • Sample

    240810-fgasaawglk

  • MD5

    84dbe15e3cd7b766cadce1a32d873004

  • SHA1

    28bc25c8bf2cc6779cd57e11f30a9eb906a882d2

  • SHA256

    8563c9cba2f9397e130ae44d75903db5c1998ae0001bfb7f92325b3a436d696e

  • SHA512

    33a313ed0b847831430e0a7f0f669cca57041879b399793acf5db3b7c11f4f6ed6a264b4d30c41f3dd9a4a4f9f069b8ffa1746b2120ebde681997c2898744bea

  • SSDEEP

    6144:QfwD/eHK1rGTAOfrIV/QHxOtJkkgYsGGdzKLK:QfwDz1+q4Hsi+LK

Score
10/10
gandcrabbackdoordiscoverypersistenceransomware

Malware Config

Targets

    • Target

      84dbe15e3cd7b766cadce1a32d873004_JaffaCakes118

    • Size

      321KB

    • MD5

      84dbe15e3cd7b766cadce1a32d873004

    • SHA1

      28bc25c8bf2cc6779cd57e11f30a9eb906a882d2

    • SHA256

      8563c9cba2f9397e130ae44d75903db5c1998ae0001bfb7f92325b3a436d696e

    • SHA512

      33a313ed0b847831430e0a7f0f669cca57041879b399793acf5db3b7c11f4f6ed6a264b4d30c41f3dd9a4a4f9f069b8ffa1746b2120ebde681997c2898744bea

    • SSDEEP

      6144:QfwD/eHK1rGTAOfrIV/QHxOtJkkgYsGGdzKLK:QfwDz1+q4Hsi+LK

    Score
    10/10
    gandcrabbackdoordiscoverypersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks